Username Enumeration
Track a username or alias across multiple platforms in CTF OSINT challenges.
Username Enumeration
Username enumeration challenges give you a handle or alias and ask you to find accounts on multiple platforms, discover personal information, or locate a specific post/photo.
Username enumeration tools like Sherlock and Maigret send HTTP requests to hundreds of platforms. Only use them against usernames you are authorized to investigate - in CTF challenges or with explicit permission. Aggressive automated scanning may violate a platform's Terms of Service.
Note: Automated username scans produce false positives. Validate accounts by cross-checking profile photos, unique bio phrases, commit emails, or timestamps before accepting results as authoritative.
Investigation Workflow
Manual Search
Start with a quick Google dork:
"targetusername" site:twitter.com
"targetusername" site:github.com
"targetusername" site:reddit.com
"targetusername" site:instagram.com
"targetusername" site:linkedin.com
"targetusername" site:pastebin.com
"targetusername" site:hackthebox.comAlso try Bing and Yandex - they index different content.
Tool: Sherlock
Sherlock searches for a username across 400+ platforms:
pip3 install sherlock-projectTool: Maigret
Maigret is a more advanced version of Sherlock with person profiling:
pip3 install maigretManual Platform Checks
Some platforms worth checking manually:
| Platform | URL Pattern | Notes |
|---|---|---|
| GitHub | github.com/username | Check repos, gists, PRs |
| Twitter/X | twitter.com/username | Check bio, tweets, replies |
| reddit.com/u/username | Posts, comments, subs | |
| instagram.com/username | Photos, stories | |
| linkedin.com/in/username | Work history | |
| HackTheBox | hackthebox.com/profile/... | CTF player profile |
| CTFtime | ctftime.org/user/... | CTF history |
| Keybase | keybase.io/username | Crypto keys, proofs |
| Gravatar | gravatar.com/username | Email-linked avatar |
| Steam | steamcommunity.com/id/username | Gaming profile |
Email from Username
If you know the username, you might derive their email:
username@gmail.com
username@protonmail.com
username@outlook.com
firstname.lastname@company.comVerify an email exists (without sending a message) via:
- Hunter.io - email finder for company domains
- SMTP
VRFYcommand (often disabled)
Reverse Username - Find the Person
Identify the pattern
Is the username a real name, leet-speak, or an alias? Look for numbers substituting vowels.
# Decode common username transformations
username = "j0hn_d03"
# → likely "john_doe"
# → try firstname.lastname@company.com
# Numbers for vowels (leet speak)
# a→4, e→3, i→1, o→0, u→vGenerate variations
# Common variations:
username # exact
username_ # trailing underscore
_username # leading underscore
username123 # trailing numbers
username2024 # year appended
firstname.lastname
f.lastname
firstnamelastnameSearch across search engines
Try the username (and its variations) in Google, Bing, and Yandex. Different engines index different content.
Run automated tools
Sherlock for breadth, Maigret for depth and profiling. Cross-reference found accounts.
Cross-Reference Accounts
Once you find multiple accounts, look for:
- Profile photos - reverse image search to find more accounts
- Bio text - copy unique phrases to Google
- Friend lists - same friends appear across platforms
- Location - tagged photos, check-ins
- Email - sometimes visible in GitHub commits
# Find email in GitHub commits
git clone https://github.com/username/repo.git
cd repo
git log --format="%ae" | sort -uGitHub is the single richest source of real email addresses in OSINT. Even developers who use pseudonyms often configure Git with their real email. The email appears in every commit and is retrievable without authentication via the GitHub API: https://api.github.com/users/username/events/public
Checking for Leaked Credentials
Checklist
Last updated on